Samsung představil headset Galaxy XR se 4K Micro-OLED displeji, procesorem Snapdragon XR2+ Gen 2, 16 GB RAM, 256 GB úložištěm, operačním systémem Android XR a Gemini AI.
Před konferencí Next.js Conf 2025 bylo oznámeno vydání nové verze 16 open source frameworku Next.js (Wikipedie) pro psaní webových aplikací v Reactu. Přehled novinek v příspěvku na blogu.
Sovereign Tech Fund oznámil finanční podporu následujících open source projektů: Scala, SDCC, Let's Encrypt, Servo, chatmail, Drupal, Fedify, openprinting, PHP, Apache Arrow, OpenSSL, R Project, Open Web Docs, conda, systemd a phpseclib.
Bylo vydáno OpenBSD 7.8. S předběžnou podporou Raspberry Pi 5. Opět bez písničky.
Valkey (Wikipedie) byl vydán v nové major verzi 9.0. Valkey je fork Redisu.
Byly publikovány informace o kritické zranitelnosti v knihovně pro Rust async-tar a jejích forcích tokio-tar, krata-tokio-tar a astral-tokio-tar. Jedná se o zranitelnost CVE-2025-62518 s CVSS 8.1. Nálezci je pojmenovali TARmageddon.
AlmaLinux přinese s verzí 10.1 podporu btrfs. XFS bude stále jako výchozí filesystém, ale instalátor nabídne i btrfs. Více informací naleznete v oficiálním oznámení.
Společnost OpenAI představila svůj vlastní webový prohlížeč ChatGPT Atlas. Zatím je k dispozici pouze na macOS.
Desktopové prostředí KDE Plasma bylo vydáno ve verzi 6.5 (Mastodon). Přehled novinek i s videi a se snímky obrazovek v oficiálním oznámení. Podrobný přehled v seznamu změn.
Rodina jednodeskových počítačů Orange Pi se rozrostla (𝕏) o Orange Pi 6 Plus.
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.0 1944 644 ? Ss 11:06 0:02 init [2] root 2 0.0 0.0 0 0 ? S 11:06 0:00 [migration/0] root 3 0.0 0.0 0 0 ? SN 11:06 0:00 [ksoftirqd/0] root 4 0.0 0.0 0 0 ? S< 11:06 0:00 [events/0] root 5 0.0 0.0 0 0 ? S< 11:06 0:00 [khelper] root 6 0.0 0.0 0 0 ? S< 11:06 0:00 [kthread] root 9 0.0 0.0 0 0 ? S< 11:06 0:00 [kblockd/0] root 10 0.0 0.0 0 0 ? S< 11:06 0:00 [kacpid] root 75 0.0 0.0 0 0 ? S< 11:06 0:00 [kseriod] root 109 0.0 0.0 0 0 ? S 11:06 0:00 [pdflush] root 110 0.0 0.0 0 0 ? S 11:06 0:00 [pdflush] root 111 0.0 0.0 0 0 ? S< 11:06 0:00 [kswapd0] root 112 0.0 0.0 0 0 ? S< 11:06 0:00 [aio/0] root 555 0.0 0.0 0 0 ? S< 11:06 0:00 [khubd] root 813 0.0 0.0 0 0 ? S< 11:06 0:03 [kjournald] root 974 0.0 0.0 2180 600 ? S< 11:06 0:00 udevd --daemon root 1236 0.0 0.0 0 0 ? S< 11:06 0:00 [kpsmoused] root 1469 0.0 0.0 0 0 ? S< 11:06 0:00 [kmirrord] root 1670 0.0 0.0 1624 616 ? Ss 11:06 0:03 /sbin/syslogd root 1676 0.0 0.0 1576 380 ? Ss 11:06 0:00 /sbin/klogd -x root 1722 0.0 0.1 2664 1332 ? S 11:06 0:00 /bin/sh /usr/bin/mysqld_safe mysql 1759 0.6 4.0 129908 42028 ? Sl 11:06 2:17 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/run/mysqld/mysqld.pid --skip-external-locking --port=3306 --socket=/var/run/mysqld/mysqld.sock root 1760 0.0 0.0 1560 508 ? S 11:06 0:00 logger -p daemon.err -t mysqld_safe -i -t mysqld root 1886 0.0 0.0 1576 560 ? Ss 11:06 0:00 /usr/sbin/acpid -c /etc/acpi/events -s /var/run/acpid.socket root 1895 0.0 0.0 1748 576 ? Ss 11:06 0:00 /usr/sbin/inetd root 1955 0.0 0.1 4808 1604 ? Ss 11:06 0:00 /usr/lib/postfix/master postfix 1962 0.0 0.1 4856 1700 ? S 11:06 0:00 qmgr -l -t fifo -u root 2013 0.0 0.0 1920 576 ? Ss 11:06 0:00 /usr/sbin/dovecot root 2026 0.0 0.0 2196 880 ? Ss 11:06 0:00 /usr/sbin/cron root 2038 0.0 0.1 8360 2060 ? S 11:06 0:00 dovecot-auth dovecot 2039 0.0 0.1 3296 1480 ? S 11:06 0:00 pop3-login dovecot 2040 0.0 0.1 3296 1484 ? S 11:06 0:00 pop3-login dovecot 2041 0.0 0.1 3296 1484 ? S 11:06 0:00 pop3-login dovecot 2042 0.0 0.1 3300 1480 ? S 11:06 0:00 imap-login dovecot 2043 0.0 0.1 3300 1480 ? S 11:06 0:00 imap-login dovecot 2044 0.0 0.1 3304 1480 ? S 11:06 0:00 imap-login root 2045 0.0 1.1 28344 11448 ? Ss 11:06 0:00 /usr/sbin/apache2 -k start root 2067 0.0 0.0 1576 496 tty1 Ss+ 11:06 0:00 /sbin/getty 38400 tty1 root 2068 0.0 0.0 1576 492 tty2 Ss+ 11:06 0:00 /sbin/getty 38400 tty2 root 2069 0.0 0.0 1572 492 tty3 Ss+ 11:06 0:00 /sbin/getty 38400 tty3 root 2070 0.0 0.0 1576 496 tty4 Ss+ 11:06 0:00 /sbin/getty 38400 tty4 root 2071 0.0 0.0 1572 492 tty5 Ss+ 11:06 0:00 /sbin/getty 38400 tty5 root 2072 0.0 0.0 1572 492 tty6 Ss+ 11:06 0:00 /sbin/getty 38400 tty6 root 2074 0.0 0.0 1576 500 ttyS1 Ss+ 11:06 0:00 /sbin/getty -L ttyS1 9600 vt100 postfix 2436 0.0 0.1 4868 1992 ? S 11:08 0:00 tlsmgr -l -t unix -u -c root 2615 0.0 0.1 2284 1256 ? Ss 11:10 0:01 bash root 3068 0.0 0.0 1576 500 ttyS0 Ss+ 11:13 0:00 /sbin/getty -L ttyS0 9600 vt100 root 19243 0.0 0.2 7692 2284 ? Ss 12:14 0:00 sshd: souki [priv] souki 19334 0.0 0.1 7692 1592 ? S 12:14 0:00 sshd: souki@pts/0 souki 19336 0.0 0.1 4480 1972 pts/0 Ss 12:14 0:00 -sh root 20639 0.0 0.2 7852 2376 ? Ss 12:18 0:00 sshd: root@pts/1 root 20735 0.0 0.1 3996 1728 pts/1 Ss+ 12:18 0:00 -bash postfix 22723 0.0 0.1 4820 1560 ? S 16:04 0:00 pickup -l -t fifo -u -c www-data 30108 0.4 1.0 28872 11088 ? S 17:02 0:03 /usr/sbin/apache2 -k start www-data 30118 0.1 0.9 28720 9984 ? S 17:02 0:01 /usr/sbin/apache2 -k start www-data 30125 0.2 1.1 29080 11408 ? S 17:02 0:02 /usr/sbin/apache2 -k start www-data 30128 0.1 0.9 28692 10020 ? S 17:02 0:01 /usr/sbin/apache2 -k start www-data 30851 0.3 1.0 28772 11016 ? S 17:05 0:02 /usr/sbin/apache2 -k start www-data 30878 0.3 0.9 28684 9872 ? S 17:05 0:02 /usr/sbin/apache2 -k start www-data 31272 0.5 0.9 28768 9884 ? S 17:09 0:02 /usr/sbin/apache2 -k start www-data 31569 1.1 0.9 28704 9896 ? S 17:15 0:01 /usr/sbin/apache2 -k start www-data 31571 0.6 0.9 28704 10012 ? S 17:15 0:01 /usr/sbin/apache2 -k start www-data 31604 0.8 0.9 28676 9856 ? S 17:15 0:01 /usr/sbin/apache2 -k start postfix 31736 0.0 0.2 5180 2656 ? S 17:17 0:00 smtpd -n smtp -t inet -u -c postfix 31737 0.0 0.1 4816 1576 ? S 17:17 0:00 proxymap -t unix -u postfix 31738 0.0 0.1 4816 1580 ? S 17:17 0:00 anvil -l -t unix -u -ca popr jeste vypis souboru v /etc/init.d
acpid ifupdown mysql sendsigs apache2 ifupdown-clean mysql-ndb single bootclean keymap.sh mysql-ndb-mgm skeleton bootlogd killprocs networking spamassassin bootmisc.sh klogd openbsd-inetd ssh checkfs.sh libdevmapper1.02 postfix stop-bootlogd checkroot.sh makedev procps.sh stop-bootlogd-single console-screen.sh module-init-tools proftpd sysklogd cron mountall-bootclean.sh pure-ftpd udev dovecot mountall.sh rc udev-mtab exim4 mountdevsubfs.sh rc.local umountfs glibc.sh mountkernfs.sh rcS umountnfs.sh halt mountnfs-bootclean.sh README umountroot hostname.sh mountnfs.sh reboot urandom hwclock.sh mtab.sh rmnologin x11-commonPredem dekuji za kazdou radu. PS: Pokud potrebujete jeste nejaky vypis rad dodam
Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 195.47.67.109:39898 195.144.12.5:ircd ESTABLISHED tcp 0 0 195.47.67.109:36603 undernet.irc.juste:6661 ESTABLISHED tcp 0 0 195.47.67.109:60146 undernet.xs4all.nl:ircd ESTABLISHED tcp6 0 0 ::ffff:195.47.67.10:www vpscomp.tgnet.cz:1138 ESTABLISHED tcp6 0 0 ::ffff:195.47.67.10:www vpscomp.tgnet.cz:1139 ESTABLISHED tcp6 0 0 ::ffff:195.47.67.10:ssh 12.219.forpsi.net:27770 ESTABLISHED tcp6 0 132 ::ffff:195.47.67.10:ssh 12.219.forpsi.net:27656 ESTABLISHED Active UNIX domain sockets (w/o servers) Proto RefCnt Flags Type State I-Node Path unix 2 [ ] DGRAM 2759 @/org/kernel/udev/udevd unix 10 [ ] DGRAM 4246 /dev/log unix 3 [ ] STREAM CONNECTED 323137 /var/run/mysqld/mysqld.sock unix 3 [ ] STREAM CONNECTED 323136 unix 2 [ ] DGRAM 311016 unix 2 [ ] DGRAM 91751 unix 3 [ ] STREAM CONNECTED 91748 unix 3 [ ] STREAM CONNECTED 91747 unix 2 [ ] DGRAM 8960 unix 3 [ ] STREAM CONNECTED 5089 /var/run/dovecot/login/default unix 3 [ ] STREAM CONNECTED 5088 unix 3 [ ] STREAM CONNECTED 5085 /var/run/dovecot/login/default unix 3 [ ] STREAM CONNECTED 5084 unix 3 [ ] STREAM CONNECTED 5081 /var/run/dovecot/login/default unix 3 [ ] STREAM CONNECTED 5080 unix 3 [ ] STREAM CONNECTED 5077 /var/run/dovecot/login/default unix 3 [ ] STREAM CONNECTED 5076 unix 3 [ ] STREAM CONNECTED 5073 /var/run/dovecot/login/default unix 3 [ ] STREAM CONNECTED 5072 unix 3 [ ] STREAM CONNECTED 5069 /var/run/dovecot/login/default unix 3 [ ] STREAM CONNECTED 5068 unix 3 [ ] STREAM CONNECTED 5062 unix 3 [ ] STREAM CONNECTED 5061 unix 3 [ ] STREAM CONNECTED 5059 unix 3 [ ] STREAM CONNECTED 5058 unix 3 [ ] STREAM CONNECTED 5056 unix 3 [ ] STREAM CONNECTED 5055 unix 3 [ ] STREAM CONNECTED 5053 unix 3 [ ] STREAM CONNECTED 5052 unix 3 [ ] STREAM CONNECTED 5050 unix 3 [ ] STREAM CONNECTED 5049 unix 3 [ ] STREAM CONNECTED 5047 unix 3 [ ] STREAM CONNECTED 5046 unix 3 [ ] STREAM CONNECTED 5042 unix 3 [ ] STREAM CONNECTED 5041 unix 2 [ ] DGRAM 4994 unix 2 [ ] DGRAM 4870 unix 3 [ ] STREAM CONNECTED 4853 unix 3 [ ] STREAM CONNECTED 4852 unix 3 [ ] STREAM CONNECTED 4849 unix 3 [ ] STREAM CONNECTED 4848 unix 3 [ ] STREAM CONNECTED 4845 unix 3 [ ] STREAM CONNECTED 4844 unix 3 [ ] STREAM CONNECTED 4841 unix 3 [ ] STREAM CONNECTED 4840 unix 3 [ ] STREAM CONNECTED 4837 unix 3 [ ] STREAM CONNECTED 4836 unix 3 [ ] STREAM CONNECTED 4833 unix 3 [ ] STREAM CONNECTED 4832 unix 3 [ ] STREAM CONNECTED 4829 unix 3 [ ] STREAM CONNECTED 4828 unix 3 [ ] STREAM CONNECTED 4825 unix 3 [ ] STREAM CONNECTED 4824 unix 3 [ ] STREAM CONNECTED 4821 unix 3 [ ] STREAM CONNECTED 4820 unix 3 [ ] STREAM CONNECTED 4817 unix 3 [ ] STREAM CONNECTED 4816 unix 3 [ ] STREAM CONNECTED 4813 unix 3 [ ] STREAM CONNECTED 4812 unix 3 [ ] STREAM CONNECTED 4809 unix 3 [ ] STREAM CONNECTED 4808 unix 3 [ ] STREAM CONNECTED 4805 unix 3 [ ] STREAM CONNECTED 4804 unix 3 [ ] STREAM CONNECTED 4801 unix 3 [ ] STREAM CONNECTED 4800 unix 3 [ ] STREAM CONNECTED 4797 unix 3 [ ] STREAM CONNECTED 4796 unix 3 [ ] STREAM CONNECTED 4793 unix 3 [ ] STREAM CONNECTED 4792 unix 3 [ ] STREAM CONNECTED 4789 unix 3 [ ] STREAM CONNECTED 4788 unix 3 [ ] STREAM CONNECTED 4785 unix 3 [ ] STREAM CONNECTED 4784 unix 3 [ ] STREAM CONNECTED 4781 unix 3 [ ] STREAM CONNECTED 4780 unix 3 [ ] STREAM CONNECTED 4777 unix 3 [ ] STREAM CONNECTED 4776 unix 3 [ ] STREAM CONNECTED 4773 unix 3 [ ] STREAM CONNECTED 4772 unix 3 [ ] STREAM CONNECTED 4769 unix 3 [ ] STREAM CONNECTED 4768 unix 3 [ ] STREAM CONNECTED 4765 unix 3 [ ] STREAM CONNECTED 4764 unix 3 [ ] STREAM CONNECTED 4761 unix 3 [ ] STREAM CONNECTED 4760 unix 3 [ ] STREAM CONNECTED 4757 unix 3 [ ] STREAM CONNECTED 4756 unix 3 [ ] STREAM CONNECTED 4754 unix 3 [ ] STREAM CONNECTED 4753 unix 3 [ ] STREAM CONNECTED 4750 unix 3 [ ] STREAM CONNECTED 4749 unix 3 [ ] STREAM CONNECTED 4747 unix 3 [ ] STREAM CONNECTED 4746 unix 2 [ ] DGRAM 4738 unix 2 [ ] DGRAM 4346 unix 2 [ ] DGRAM 4261
Zkusime se tam dostat (kdyz vime ze to jde) ? 
.
18.8.2007 09:58
Václav "Darm" Novák | skóre: 26
| blog: Darmovy_kecy
| Bechyně / Praha
$ whois 195.47.67.109 [Querying whois.ripe.net] [whois.ripe.net] % This is the RIPE Whois query server #3. % The objects are in RPSL format. % % Rights restricted by copyright. % See http://www.ripe.net/db/copyright.html % Note: This output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '195.47.67.0 - 195.47.67.255' inetnum: 195.47.67.0 - 195.47.67.255 netname: STICKFISH-RACK descr: Stickfish, s.r.o. descr: Rehorova 54/1039 descr: Praha 3 descr: 13000 country: cz admin-c: FK476-RIPE tech-c: FK476-RIPE status: ASSIGNED PA remarks: uid=rack1.nagano mnt-by: AS6721-MNT source: RIPE # FilteredTakze to vypada, ze mas server u abchostingu? Ze by tam davali slaby snadno uhadnutelny hesla? No fuj.
Takze to vypada, ze mas server u abchostingu? Ze by tam davali slaby snadno uhadnutelny hesla? No fuj.Aj antireklama je reklama
AbcLinuxu.cz
ITBiz.cz
HDmag.cz
AbcPráce.cz
18.8.2007 11:20
ps -AfH (ps -faeH) processy jeden po druhém a prověřovat je ... než narazíš na něco, co tam nemá být.
tcp 0 0 195.47.67.109:60146 194.109.20.90:6667 ESTABLISHED2615/bashproces 2615 - bash, kde je videt ze se konekti na irc server na port 6667 Zkus, jestli je videt prikazem ps, a najdi jeho binarku... Doporucuju nejako knizku o "hackingu", kde jsou popsane postupy co delat kdyz je stroj napaden.
18.8.2007 12:43
apt-get install clamav
disable_functions = dl, system, shell_exec, exec, escapeshellarg, escapeshellcmd, passthru, proc_close, proc_open, proc_get_status, proc_nice, proc_open, proc_terminate, popen, pclose, disk_free_space, disk_total_space, diskfreespace, fileinode
/sbin/iptables -A INPUT -i eth0 -p TCP -s x.x.x.x --dport 22 -j ACCEPT
misto x.x.x.x dosadis IP adresu ze ktere bude povolen pristup na ssh. Ale pokud nemas zadny firewall, tak je ti to k nicemu, protoze tech pravidel je mnohem vice. Jestli nemas, muzu sem dat kopletni firewall script pro hostingovy server.
#!/bin/sh
#
# fw-on - script pro spusteni firewallu
#
# Prevzato od Mirka Petricka http://www.petricek.cz
#
# Upraveno by B0biN
# IP adresa a vnejsi rozhrani
INET_IP="X.X.X.X"
INET_IFACE="eth0"
# Lokalni loopback rozhrani
LO_IFACE="lo"
LO_IP="127.0.0.1/32"
# Cesta k programu iptables
IPTABLES="/sbin/iptables"
# Inicializace databaze modulu
/sbin/depmod -a
# Zavedeme moduly pro nestandardni cile
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_REJECT
# Modul pro FTP prenosy
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
# Vypneme routovani paketu
echo "0" > /proc/sys/net/ipv4/ip_forward
echo "0" > /proc/sys/net/ipv4/tcp_syncookies
# rp_filter na zamezeni IP spoofovani
for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo "1" > ${interface}
done
# Implicitni politikou je zahazovat nepovolene pakety
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
#
# Pridavne retezce pro snazsi kontrolu na rezervovane adresy
#
# Zahazovat a logovat (max. 5 x 3 pakety za hod)
$IPTABLES -N logdrop
$IPTABLES -A logdrop -m limit --limit 5/h --limit-burst 3 -j LOG --log-prefix "Rezervovana adresa: "
$IPTABLES -A logdrop -j DROP
# V tomto retezci se kontroluje, zda prichozi pakety nemaji nesmyslnou IP adresu
$IPTABLES -N IN_FW
$IPTABLES -A IN_FW -s 192.168.0.0/16 -j logdrop # rezervovano podle RFC1918
$IPTABLES -A IN_FW -s 10.0.0.0/8 -j logdrop # ---- dtto ----
$IPTABLES -A IN_FW -s 172.16.0.0/12 -j logdrop # ---- dtto ----
$IPTABLES -A IN_FW -s 96.0.0.0/4 -j logdrop # rezervovano podle IANA
# ... dalsi rezervovane adresy mozno doplnit podle
# http://www.iana.com/assignments/ipv4-address-space
# TOS flagy slouzi k optimalizaci datovych cest. Pro ssh, ftp a telnet
# pozadujeme minimalni zpozdeni. Pro ftp-data zase maximalni propostnost
$IPTABLES -t mangle -A PREROUTING -p tcp --sport ssh -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A PREROUTING -p tcp --dport ssh -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A PREROUTING -p tcp --sport ftp -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A PREROUTING -p tcp --dport telnet -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A PREROUTING -p tcp --sport ftp-data -j TOS --set-tos Maximize-Throughput
#
# Retezec INPUT
#
# Portscan s nastavenym SYN,FIN
$IPTABLES -A INPUT -p tcp -i $INET_IFACE --tcp-flags SYN,FIN SYN,FIN -j LOG -m limit --limit 10/m --log-prefix="bogus packet: "
$IPTABLES -A INPUT -p tcp -i $INET_IFACE --tcp-flags SYN,FIN SYN,FIN -j DROP
# Pravidla pro povolene sluzby
$IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 20 -j ACCEPT #FTP server
$IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 21 -j ACCEPT #FTP server
$IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 25 -j ACCEPT #SMTP server
$IPTABLES -A INPUT -i $INET_IFACE -p UDP --dport 53 -j ACCEPT #DNS server UDP
$IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 53 -j ACCEPT #DNS server TCP
$IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 80 -j ACCEPT #WWW server
$IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 110 -j ACCEPT #POP3 server
$IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 143 -j ACCEPT #IMAP server
$IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 443 -j ACCEPT #HTTPS server
#Povoleni pro SSH z urcite IP adresy
$IPTABLES -A INPUT -i $INET_IFACE -s X.X.X.X -p TCP --dport 22 -j ACCEPT # misto X.X.X.X dosadit IP ze ktere je povoleno ssh
# Sluzbu AUTH neni dobre filtrovat pomoci DROP, protoze to muze
# vest k prodlevam pri navazovani nekterych spojeni. Proto jej
# sice zamitneme, ale tak, aby nedoslo k nezadoucim prodlevam.
$IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 113 -m limit --limit 12/h -j LOG
$IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 113 -j REJECT --reject-with tcp-reset #AUTH server
# Propoustime pouze ICMP ping
$IPTABLES -A INPUT -i $INET_IFACE -p ICMP --icmp-type echo-request -j ACCEPT
# Loopback neni radno omezovat
$IPTABLES -A INPUT -i $LO_IFACE -j ACCEPT
# Pakety od navazanych spojeni jsou v poradku
$IPTABLES -A INPUT -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
# Vsechno ostatni je zakazano - tedy logujeme, maxim. 12x5 pkt/hod
$IPTABLES -A INPUT -m limit --limit 12/h -j LOG --log-prefix "INPUT drop: "
#
# Retezec OUTPUT
#
# TOS flagy slouzi k optimalizaci datovych cest. Pro ssh, ftp a telnet
# pozadujeme minimalni zpozdeni. Pro ftp-data zase maximalni propostnost
$IPTABLES -t mangle -A OUTPUT -o $INET_IFACE -p tcp --sport ssh -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport ssh -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $INET_IFACE -p tcp --sport ftp -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport ftp -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport telnet -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $INET_IFACE -p tcp --sport ftp-data -j TOS --set-tos Maximize-Throughput
# Povolime odchozi pakety, ktere maji nase IP adresy
$IPTABLES -A OUTPUT -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -s $INET_IP -j ACCEPT
# Ostatni pakety logujeme (nemely by byt zadne takove)
$IPTABLES -A OUTPUT -j LOG --log-prefix "OUTPUT drop: "
#!/bin/bash
IPTABLES="/sbin/iptables"
function delete_chain() {
echo -n "$1/$2: ";
while [ -z "`$IPTABLES -t $1 -D $2 1 2>&1 `" ]; do
echo -n "#"
done
echo " OK";
}
$IPTABLES -t filter -P INPUT ACCEPT
$IPTABLES -t filter -P OUTPUT ACCEPT
$IPTABLES -t filter -P FORWARD ACCEPT
delete_chain filter INPUT;
delete_chain filter OUTPUT;
delete_chain filter FORWARD;
delete_chain filter IN_FW;
delete_chain filter logdrop;
delete_chain filter syn-flood;
$IPTABLES -X IN_FW 2> /dev/null;
$IPTABLES -X logdrop 2> /dev/null;
$IPTABLES -X syn-flood 2> /dev/null;
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
delete_chain nat PREROUTING;
delete_chain nat OUTPUT;
delete_chain nat POSTROUTING;
$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
delete_chain mangle PREROUTING;
delete_chain mangle OUTPUT;
#!/bin/sh -e
# Start a stop firewallu
#
case "$1" in
start)
echo -n "Spoustim Firewall"
echo ""
/usr/local/sbin/fw-on
echo ""
echo "Firewall spusten!"
;;
stop)
echo -n "Zastavuji Firewall!"
echo ""
/usr/local/sbin/fw-off
echo ""
echo "Firewall zastaven!"
;;
restart)
$0 stop || true
$0 start
;;
status)
echo ""
/sbin/iptables -L -n
echo ""
;;
*)
echo "Pouziti: /etc/init.d/firewall {start|stop|restart|status}"
exit 1
;;
esac
exit 0
Tiskni
Sdílej:
